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Abstract— Gaganyaan program represents India’s inaugural 
endeavour to establish human presence in Earth’s Low Earth 
Orbit. The Orbital module is designed to accommodate 
astronauts and various electronic systems like environment 
monitoring systems, crew display systems, cabin lighting 
systems, camera systems, communication systems, audio- 
video processing systems, etc. Crew Cabin Systems Controller 
(CCSC) Module is an integral part of Audio Video Processing 
System that serves as a crucial intermediary between on- 
board electronics and Mission Computers for Tele-Command 
& Telemetry information exchange. This paper offers a 
comprehensive exploration of the design of Fault Tolerant 
Crew Cabin Systems Controller for the Gaganyaan mission. 


Keywords—Crew Cabin System Controller (CCSQ), Mission 
Computer (MC), RISC (Reduced Instruction Set Computer), 
Electronic Power Conditioner (EPO, Field 
Programmable Gate Array (FPGA), Tele-Command 
(TO, Telemetry (TM). 


I. INTRODUCTION 


India's highly anticipated and cutting-edge mission, 
'Gaganyaan', is poised to launch the Orbital module 
housing Indian astronauts aboard Human Rated Launch 
Vehicle into low Earth orbit. During its 5-7 day mission, 
the spacecraft will not only demonstrate India's prowess in 
the science and technology sector but also serve as a 
testament to its capabilities in space exploration. 


The Orbital Module boasts state-of-the-art avionics 
systems designed with human safety as the paramount 
concern. Within the Crew Module, a habitable environment 
akin to Earth is meticulously crafted, housing essential 
interfaces, life support systems, avionics, and other human- 
centric necessities for the crew's well-being. 
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Communication between the crew and ground control 
is facilitated through on-board Mission Computers (MC), 
which, in turn, interface with other on-board systems via 
Crew Cabin Systems Controller (CCSC). CCSC serves as 
the central entity responsible for managing Tele-Command 
(TC) distribution and Telemetry (TM) monitoring of 
various on-board systems. Fault tolerance & dual modular 
redundancy are ensured with the deployment of two hot- 
redundant CCSC units to safeguard against system failures. 
Three independent MIL-STD-1553 links with complete 
redundancy in hardware & software chains is implemented 
to communicate with three independent MCs. Its robust 
software architecture is meticulously designed to handle 
TCs from multiple Mission Computers, ensuring efficient 
bus arbitration and response mechanisms that poses a 
significant design challenge for CCSC, as elaborated in 
subsequent sections of this paper. 
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Fig. 1: CCSC Interface with Mission Computer and On-board systems 


Authorized licensed use limited to: KIIT University. Downloaded on October 02,2024 at 11:13:42 UTC from IEEE Xplore. Restrictions apply. 


2024 IEEE Space, Aerospace and Defence Conference (SPACE) 


Crew Cabin Systems Controller serves as a 
sophisticated embedded control system, seamlessly 
integrating state-of-the-art hardware and embedded 
software. CCSC hardware utilises all Space-qualified 
components to offer highest reliability in space 
environment. Hardware level cross patching is 
implemented between two CCSC units and interfacing 
subsystems to ensure seamless connectivity. Intricate 
interconnections between three MCs, two CCSCs, and 
multiple other crew cabin systems is illustrated in Fig. 1, 
highlighting the complex yet reliable architecture of the 
Gaganyaan mission. 


Il. CCSC SYSTEM REQUIREMENTS 


Crew Cabin Systems Controller addresses following 
major system requirements: 


e Manage power On-Off controls and power TM 
acquisition for interfacing Crew Cabin systems. 

© Coordinate Serial TC generation and TM Reception 
Communication systems. 

e Collect Analog & Thermistor TM from various 
interfacing systems to monitor temperature. 

e Establish interface with three MCs for MIL-STD- 
1553B TC-TM communication. 

e Implement bus arbitration & time-out qualifier logic 
for fault tolerant seamless TC-TM communication 
over three MIL-STD-1553 buses with three MCs 
concurrently. 

e Facilitate two-way Serial Communication with Audio 
Video Processing Unit via 3-wire serial interface for 


Crew Cabin Display Parameter information 
exchange. 
IH. CCSC HARDWARE OVERVIEW 


Gaganyaan Crew Cabin Systems Controller hardware 
design is centric to Microchip RTG4 FPGA device to 
execute specified functionalities. RTG4 FPGA provides an 
advantage of low power, live at power on and re- 
programmability even at the advanced stages of package 
integration compared to SRAM and Antifuse based 
FPGAs. Furthermore, choice of soft processor core over 
hardware chip was made for miniaturization in terms of 
Size, Weight and Power (SWaP). CCSC_ hardware 
accommodates 16 Mb Non-Volatile Magneto-Resistive 
RAM (MRAM) device for storing on-board application 
code based on the RISC-V processor, accessed by RTG4 
FPGA for execution. Powered by +5.0 Volts input supply 
from the Electronic Power Conditioner (EPC) subsystem, 
the CCSC hardware employs on-board LDO & POL 
devices to generate additional necessary voltage supplies. 
It incorporates three MIL-STD-1553 Bus Interface devices 
to establish communication with all three Mission 
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Computers via individual MIL-STD-1553 links. If any of 
the MIL-STD-1553 link fails, communication is not 
hampered through smooth switchover from one link to 
another. 


48-MHz on-board clock oscillator device serves as the 
master clock source for CCSC hardware. The hardware 
integrates various buffer and transceiver ICs to 
accommodate different interface types, such as 
Complementary Metal Oxide Semiconductor (CMOS), 
RS-422, RS-485, Low Voltage Differential Standard 
(LVDS), etcetera, with various subsystems. 


For receiving temperature telemetries from other 
subsystems, CCSC hardware includes provisions for on- 
board ADC devices. Additionally, it houses an on-board 
Watch Dog Timer device to serve as a fault detection and 
recovery feature mechanism. Developmental Model 
(DVM) hardware photograph and Block level detail of 
CCSC hardware are shown in Fig. 2 & Fig. 3 respectively. 


Fig. 2: CCSC Hardware 
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Fig. 3: CCSC Hardware Block Diagram 


IV. CCSC SOFTWARE OVERVIEW 
Programmable functionality of CCSC hardware is 
implemented within the Flash-based RTG4 FPGA device. 
32-bit LEON & RISC-V soft processor cores were 
explored for implementation out of which RISC-V soft 
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core with On-chip Floating Point Unit (FPU) architecture 
[1]- [3] was chosen as it is an optimised design for RTG4 
FPGA in terms of resource utilization. Various functional 
logic modules are interfaced with the processor using on- 
chip AMBA SoC Bus [4] such as in-house developed MIL- 
STD-1553 Remote Terminal Intellectual Property core [5], 
serial interface modules, Modem serial communication 
Universal Asynchronous Receiver Transmitter (UART) 
module [6], Programmable Pulse Generator Module, etc. to 
interface with various crew cabin systems. 


Application code for RISC-V Processor is stored in the 
on-board MRAM device [7], while other programmable 
logic components reside in the RTG4 FPGA's on-chip 
Flash memory. Upon power application to the hardware, 
CCSC_ hardware promptly delivers the desired 
functionality. 


CCSC RISC-V Processor Application Software is 
written in bare-metal C-language. CCSC receives TCs & 
configuration data and transmits TM data from/to Mission 
computers through three hot redundant MIL-STD-1553 
links. Mission Computers simultaneously send TC 
information to the CCSC system via three individual MIL- 
STD-1553 links. 


Bus arbitration logic, responsible for validation and 
decision-making based on received commands from 
Mission Computers, is implemented in the processor 
application code. When a TC is received from any one of 
the MIL-STD-1553 links, the arbitration logic verifies the 
validity of received commands and triggers the time-out 
qualifier logic to check the command in the other two links. 
If identical commands are received in all three MIL-STD- 
1553 links, the TC from the other two links will be 
discarded, and the software functionality will be executed 
once based on the received TC. 


A block-level architectural detail of the RTG4 FPGA 
design is depicted in Fig. 4. 


PROC_CLK 
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Fig.4: RTG4 FPGA Design Architecture 


V. HUMAN RATING CERTIFICATION 


Human Rating Design aspects [8]-[12] are considered 
for CCSC hardware design as well as_ software 
implementation as it is the prime requirement for a human 
centric mission. Fault Tree Analysis, Event Tree Analysis, 
Failure Mode Effect & Criticality Analysis, Route to 
Certification, Preliminary Hazard Analysis & Software 
Subsystem Hazard Analysis etcetera will be carried out to 
ensure human rated system design. Software design has 
been carried out following guidelines derived from ISRO 
Software Safety Standard (ISSS) and other Human Rating 
Certification guidelines. Human raring certification 
clearance will be acquired before actual integration of the 
hardware. 


VI. ELECTRONIC GROUND CHECKOUT SYSTEM 


A dedicated Ground Checkout Unit has been 
developed to evaluate the comprehensive functionality of 
CCSC_ hardware. To emulate Mission Computer 
functionality, a user-friendly Graphical User Interface 
(GUI) has been developed. This GUI software is hosted on 
an Industrial PC and facilitates communication with the 
CCSC hardware via the MIL-STD-1553 interface. 
Furthermore, a Mission Computer Simulator has been 
designed to generate various TCs and TM exchanged over 
the MIL-STD-1553 bus with the On-board MCs. 
USB/cPCI based cards are utilised to realise the MIL-STD- 
1553 interface link with CCSC. 


CCSC Subsystem operates three concurrently active 
1553 links, each interfacing individually with an MC. MC 
Simulator GUI is developed using Microsoft Visual Studio 
and implemented in the C# language. This development 
harnesses the Bus-1553 API, which supports C#, enabling 
the GUI to effectively manage protocol data over the MIL- 
STD-1553 lines. Snapshot of the Graphical User Interface 
and Mission Computer Simulator test setup block level 
diagram are provided in Fig. 5 and Fig. 6, respectively. 
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Fig. 5: Mission Computer Simulator GUI 
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Fig. 6: Electronics Ground Checkout System 


VII. HARDWARE TEST RESULTS 


The developmental model of the CCSC hardware has 
been thoroughly tested & functionally verified in an 
ambient environment. The hardware has been evaluated in 
an integrated configuration with various On-board 
subsystems and MC Simulator software. The functionality 
was validated by measuring width of pulse signals and data 
of serial streams, as well as monitoring TM on the MC 
Simulator software. Additionally, UART interface with 
Modem was confirmed by receiving serial data through the 
computer. CCSC FPGA design resource utilisation is 
shown in Table I. The design incorporates functionalities 
of Audio Video Processing Unit (AVPU) high speed serial 
interface, Modem UART interface and _ other 
programmable logic modules catering to CCSC functional 
requirements. 


TABLE I: CCSC FPGA Resource Utilization 


Type Used Total % 

4LUT 73342 151824 48.30 
D-Flip Flop 56439 151824 37.17 
RAM64x18 17 210 8.09 
RAMIKx18 120 209 57.41 


CCSC Hardware has been tested exhaustively with 
Mission computer Simulator software and AVPU 


electronics as shown in Fig. 7. Various TC-TM test cases 
have been verified to measure the command execution and 
housekeeping TM update latency on the hardware. 


q a . 
Fea a 


: CCSC Hardware Interface Test Setup 


VI. 


Crew Cabin Systems Controller subsystem serves as 
the crucial control and information link between three 
Mission Computers and numerous cabin systems on-board. 
Its responsibilities encompass overseeing the overall 
control, configuration, and status monitoring of the various 
cabin systems. TM and TC data are exchanged exclusively 
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between two hot redundant Space-qualified CCSC 
hardware and multiple MCs via individual MIL-STD-1553 
buses that provides a reliable and fault tolerant architecture. 
To handle the diverse range of TM types, including digital, 
analog, and temperature readings, as well as CMOS and 
Raw Bus TCs, the CCSC hardware is equipped with 
multiple interfaces. 


Upon receiving TCs from Mission Computers, the 
CCSC system executes power on/off commands for 
various on-board subsystems. Both the CCSC systems 
collaborate closely with multiple Mission Computer 
systems to effectively manage and control the cabin 
systems during mission operations. Both CCSCs connect 
with all interfacing crew cabin systems. Hence, even in the 
case of one system failure, the other CCSC takes over 
smoothly without compromising in any functionality. 


Throughout the design and software implementation 
of the CCSC hardware, careful attention has been paid to 
all human-rating design considerations, ensuring the 
system's reliability and safety meeting rigorous standards. 
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